authorize.conf

This configuration stores definitions of capabilities and roles. These settings affect search and the web interface. They are generally managed through the interface at Settings | Access controls, but a quick look at the configuration itself may be useful.

A role stanza looks like this:

[role_power] 
importRoles = user 
schedule_search = enabled 
rtsearch = enabled 
srchIndexesAllowed = * 
srchIndexesDefault = main 
srchDiskQuota = 500 
srchJobsQuota = 10 
rtSrchJobsQuota = 20 

Let's walk through these settings:

  • importRoles: This is a list of roles to import capabilities from. The set of capabilities will be the merging of capabilities from imported roles and added capabilities.
  • schedule_search and rtsearch: These are two capabilities ...

Get Implementing Splunk 7 - Third Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.